JP2000253038A - Firewall system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enhance the security and to relieve traffic. SOLUTION: An address of an FGDN form is discriminated in a connection request transferred from host computers 3, 4, 5 that are selected as clients in an intra-net and used for proxy/cache servers, a default root is directed toward the host computers 3, 4, 5 and not directly connected to the Internet and routed by the host computer 2 used for a proxy server. The default root is directed to the Internet in the case of connection to the Internet and connected from the host computer 2 and the connection is made by a host computer 1 used for a proxy/cache server.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a firewall device provided between the Internet and an intranet to protect data.

[0002]

2. Description of the Related Art A conventional firewall apparatus of this type is configured as shown in FIGS. 5 and 6, for example.

In the case of the conventional firewall apparatus shown in FIG. 5, a client 25 in an intranet uses a host computer 23 as a proxy server, passes over a host computer 22 constituting a firewall gateway, and uses a host computer used as a proxy / cache server. It is configured to access the Internet after connecting to the computer 21. Code 24
Indicates a router, and reference numeral 26 indicates a network.

In the host computer 22, the addresses and port numbers that can pass through are restricted, and the host computer 22 generally uses only the address of the host computer 23 on the host computer 21 on the Internet side.
It can be connected to a firewall device.

The conventional firewall device shown in FIG. 6 is simpler than the firewall device shown in FIG. 5, and the host computer 23 is omitted.
All the clients 25 in the intranet use the host computer 21 as a proxy / cache server to make an Internet connection.

[0006]

However, the firewall apparatus shown in FIG. 5 configured as described above has the following problems. (A) A large number of client connection requests are made to the host computer 23, increasing the load on the proxy server and concentrating intranet-side traffic. This complicates routing. Also,
It becomes difficult to maintain security using IP addresses.

[0007] (b) Traffic concentrates on the host computer 22. (C) When scalability is small and the scale on the intranet side is large, traffic management becomes difficult.

In the firewall device shown in FIG. 6, the configuration is simple, and all the clients in the intranet use the host computer 21 as a proxy / cache server to make an Internet connection. Need to be able to connect to the host computer 21 from all of the clients, which has the following problems.

(A) In order to realize security, a large number of global network addresses cannot be generally obtained, and all addresses of host computers in an intranet need to be private addresses.
(B) Since all the clients need to be registered in the access control of the host computers 21 and 22, the setting of the access control of the host computer 22 becomes complicated.
(C) When the scale of the network on the intranet side is increased, routing becomes more difficult than in the example of FIG. (D) Furthermore, the extensibility is lower than that shown in FIG.

[0010] It is an object of the present invention to provide a firewall device that can improve security and reduce traffic.

[0011]

According to the present invention, there is provided a firewall apparatus comprising: a plurality of first host computers which are connected to a client in an intranet, selected by an auto proxy as a client, and used as a proxy / cache server; In the connection request transferred from the first host computer, an address in the FQDN format is determined in the connection request, and routing is performed. The default route is directed to the first host computer, not directly connected to the Internet, and A second host computer used as a proxy server when used as a proxy server, and a default route directed to the Internet side, connected only from the second host computer, and a proxy / capacity when used as a server. The first is used as a shoe server 3
And a host computer.

According to the firewall device of the present invention,
The content stored in the proxy / cache server of the first host computer often hits the content requested by the client, the connection from the third host computer to the Internet decreases, and the content passes through the second host computer. The amount of data to be transmitted is reduced, and traffic is reduced. Further, since the second host computer switches the routing using the FQDN, the name service only needs to be completed on the intranet side, and there is no danger that the domain inside the intranet is known from the Internet side, and the security is improved. You.

[0013]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A firewall device according to the present invention will be described below with reference to an embodiment.

FIG. 1 is a block diagram showing the configuration of a firewall device according to an embodiment of the present invention.
FIG. 2 is a schematic diagram showing routing in the firewall device according to one embodiment of the present invention.

A firewall device according to an embodiment of the present invention has three layers as shown in FIG.

In the third layer A at the lowest level, host computers 3 to 5 connected to clients in the intranet are provided.
Is provided to manage protocols and routing. When the host computers 3 to 5 are used as servers, they are used as proxy / cache servers, and these proxy / cache servers use an auto proxy function and are arbitrarily selected by the client. Further, these proxy / cache servers are statically relayed to a host computer 2 described later.

A host computer 2 is provided on the second layer B. When the host computer 2 is used as a server, it is used as a proxy server. The reason for providing the host computer 2 is that the host computer 3,
This is for relaying connection requests from the host computers 4 and 5 to the host computer 1 described later, and for performing access control as a function of the firewall. The relay of the proxy server also relays to another proxy server in order to access the http server of another subdomain.

The host computer 1 is provided on the first layer C. When the host computer 1 is used as a server, it is used as a proxy / cache server. The host computer 1 accepts a request from the intranet, performs access control so as not to connect from the Internet, and has a cache disk memory.

The above-mentioned three-layer structure is also used for the firewall structure and the necessity of routing with another domain.

In FIG. 1, reference numerals 6 to 8 denote routers, and the router 6 is a router for making an Internet connection. In FIG. 2, reference numeral 9 indicates a client,
Reference numerals 11 and 31 denote a cache disk memory of the host computer 1, the host computer 3,
4 and 5 show cache disks.

Further description will be given. Host computer 1
Is used as a proxy / cache server when used as a server, default routing is directed to the router 6, and access to the proxy / cache server is controlled so that it can be connected only from the host computer 2.

The host computer 2 does not have a cache. In connection requests transferred from the host computers 3, 4, 5, etc., in order to reduce the burden on the host, FQDN is used instead of the expression using the IP address.
Judgment of addresses in the form of (fully, qualified, domain, name) and routing to the Internet or another subdomain. For example, foo. b
ar. com. bar. com to a domain called bar.com. A request to a domain other than “com” connects to the host computer 1.

Access control is performed so that only one of the host computers 3, 4, and 5 can be connected to the host computer 2. The default route is directed to the inside, and from the Internet side, the host computers 3, 4, and 5 are connected. 5 cannot be connected.

The host computers 3, 4, and 5 are proxy / cache servers, each having a cache function. Clients belonging to the internal network select the proxy / cache servers of the host computers 3, 4, and 5 based on the following reference rules to make connection, thereby reducing the load on the disk and network of each server.

The rule for switching the proxy / cache servers of the host computers 3, 4, and 5 by the client is that the URL character making the connection request is logically added and then divided by 3 (three proxy / cache servers are used). In the case), the host computer 3, the host computer 4, or the host computer 5 is selected by the remainder. For example, if the host computer 3 is selected in the process, but the host computer 3 is stopped, the host computer 4 is used. If the host computer 4 is stopped, the host computer 5 is used. Has rules for proxy switching. The specific switching is performed by the browser using a program supplied to the client.

Therefore, in the firewall apparatus according to the embodiment of the present invention, the host computer 3, 4, 5 can be used as a proxy / cache server when connecting to the Internet, and the cache hit rate can be increased. The number of connection requests to the host computer 1 via the host computer 2 is reduced, the load on the host computers 1 and 2 is reduced, and the
Traffic is reduced.

Next, the host computers 1, 3, 4 and 5 are provided with disk memories 11 and 31 for a cache server having a sufficiently large storage capacity, and the host computers 1, 3, 4 and 5 simultaneously open the disk memories. The hit rate is improved by increasing the number of files that can be generated, shortening the waiting time of requests, adjusting the cache parameters, and increasing the size of issuing requests to the host computer 1 serving as the proxy server at a time. The demand for connection to the Internet was reduced, and traffic was reduced.

As a result, the change of the hit rate in the host computers 3, 4, and 5 shown by the solid line, the broken line and the dashed line in each week was obtained by using the firewall apparatus according to the embodiment of the present invention as shown in FIG. The number of requests for connection to the Internet to the host computer 1 indicated by a dashed line has increased since the second week, and has decreased since the second week. FIG. 4 shows an example when the sixth week is further added. 3 and 4, the two-dot line indicates the hit ratio in the host computer.

As described above, when implementing the auto proxy, the client requests the proxy /
If the cache server is down, program it to automatically switch requests to the next proxy / cache server. Become.

When the disk memory for the cache server is divided into the host computers 3, 4, and 5, and the proxy server is switched by performing auto proxy, a request to a plurality of URLs is generally issued when one page is read. However, since this request is processed by a plurality of proxy / cache servers, the waiting time on the disk can be reduced, and the requests for the plurality of URLs are not concentrated on one proxy / cache server. In addition, the load on the disk memory and the network is reduced, and the speed is improved as compared with a single host computer.

Since the host computer 1 and the host computers 3, 4, and 5 perform two-stage caching, the apparent speed is improved. First, the probability that the requested data remains in the proxy / cache servers of the host computers 3, 4, and 5 increases, and the relay between the proxy / cache servers of the host computers 3, 4, and 5 is performed. When the proxy / cache server of the host computer 1 takes in an object, it requests a large number of objects at once, and the proxy / cache server of the host computer 3, 4, 5
The cache server divides and processes the proxy / cache server of the host computer 1 in a small amount, shortens the time for one session at a time, and facilitates the use of sessions for other purposes.
Host computer 1 and host computers 2, 3, 4
This is because the load on the network between the proxy / cache server is reduced.

Security is improved because no name service is exchanged with the Internet. Further, the amount of data passing through the host computer 2 is reduced, so that not only security but also traffic can be greatly reduced, and the connection between the host computer 1 and the host computers 3, 4, and 5 becomes smooth.

[0033]

As described above, according to the firewall apparatus of the present invention, since the second host computer switches the routing using the FQDN, the name service only needs to be completed only on the intranet side. There is no danger that the domain inside the intranet is known from the Internet side, and the security is improved.

Further, the firewall device according to the present invention has expandability in which the relay function of the proxy / cache server with another subdomain can be arbitrarily created by using the switch function of the second host computer. By performing relaying, routing between subdomains can be simplified and traffic can be reduced.

Further, according to the firewall apparatus of the present invention, the access control of the second host computer permits the connection of only the first host computer on the intranet side, and the third host computer on the Internet side also controls the access. Security is improved because only the protocol that has passed through the second host computer is permitted to be connected.

Further, according to the firewall apparatus of the present invention, since the proxy / cache servers on the intranet side are distributed, the load can be distributed, and even if one of them stops operating, it operates. It is less likely that the proxy / cache server on the side of the intranet will be acting on behalf of the Internet.

Further, according to the firewall apparatus of the present invention, a proxy / cache server can be provided below the first host computer on the intranet and relaying can be performed to further expand the network. Traffic and routing management becomes easier.

Further, according to the firewall apparatus of the present invention, the first and third servers used as proxy / cache servers on the intranet side and the Internet side.
, The traffic on the second host computer can be reduced. As networks evolve and change, so do routing and traffic,
In the firewall apparatus according to the present invention, since the functions are shared, it is possible to easily maintain the security while expanding the network.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a firewall device according to an embodiment of the present invention.

FIG. 2 is a schematic diagram showing routing in the firewall device according to one embodiment of the present invention.

FIG. 3 is an explanatory diagram for explaining an operation of the firewall device according to the embodiment of the present invention;

FIG. 4 is an explanatory diagram for explaining an operation of the firewall device according to the embodiment of the present invention;

FIG. 5 is a block diagram showing a configuration of a conventional firewall device.

FIG. 6 is a block diagram showing the configuration of another conventional firewall device.

[Explanation of symbols]

 1-5 Host computer 6-8 Router 11 and 31 Disk memory 26 Network

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 5B082 GA11 HA08 5B089 GA01 GA19 GA21 GA31 GB01 HA10 KA07 KA17 KB06 KG08 5K030 HA08 HC01 HC14 HD03 HD06 JT06 LB05 LD11 LD20 5K033 AA03 AA08 CB06 CB08 DA06 DB12 DB14 DB18 DB18 9 KK31 LZ03

Claims (1)

[Claims] 1. A plurality of first host computers which are connected by a client inside an intranet, are selected as clients by an auto proxy, and are used as a proxy / cache server, and connections transferred from the first host computer. The FQDN format address is discriminated in the request and routing is performed. The default route is directed to the first host computer side and is not directly connected to the Internet side, and when used as a server, the default route is used as a proxy server. The second host computer and the default route are directed to the Internet side,
A third host computer which is connected only from the host computer and which is used as a proxy / cache server when used as a server.